The npm package bigops-offers version 35.6.8 contains malicious code that executes a binary dropper upon import. This dropper assembles command-and-control hostnames and fetches platform-specific binaries from remote servers. It uses DNS TXT-record fallback to retrieve payload chunks, writes the payload to disguised executable files, sets execution permissions, and runs the binary detached from the main process. The code includes telemetry evasion techniques to avoid detection.